In the Linux kernel, a mismatch in the calculated allocation size for bytes controls in the SOF IPC4 topology leads to an incorrectly sized buffer behind scontrol->ipc_control_data. The kernel allocates smaller memory than required, causing potential memory corruption when control data larger than the allocated space is processed. The crash or corruption would affect kernel memory integrity, but the exact security consequences are not explicitly documented in the CVE description. Based on the description, it is inferred that a malicious actor might exploit this misallocation to corrupt kernel memory, potentially affecting system stability or security. However, exploitation for privilege escalation or remote code execution is not directly supported by the provided text.

The vulnerability affects the Linux kernel, specifically the SOF IPC4 topology functionality. No specific kernel versions are listed, so all kernels that include this code path may be impacted until a patch is applied.

The CVSS score is 5.5, and the EPSS score is < 1 %, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. While heap‑based buffer overflows in kernel space can be serious, the lack of a public exploit and the low EPSS suggest the risk remains moderate. The attack vector would require the ability to provide control data to the affected IPC path, which is typically privileged or device‑specific.